diff --git a/dot_zshrc.tmpl b/dot_zshrc.tmpl
new file mode 100644
index 0000000..9f68e33
--- /dev/null
+++ b/dot_zshrc.tmpl
@@ -0,0 +1,131 @@
+HISTFILE=~/.zsh_history
+HISTSIZE=5000
+SAVEHIST=5000
+setopt append_history           # append
+setopt hist_ignore_all_dups     # no duplicate
+setopt hist_ignore_space        # ignore space prefixed commands
+setopt hist_reduce_blanks       # trim blanks
+setopt inc_append_history       # add commands as they are typed, don't wait until shell exit
+setopt share_history            # share hist between sessions
+setopt ignoreeof                # don't exit the shell on ^D (EOF)
+
+# emacs bindings
+bindkey -e
+# make delete key work
+bindkey    "^[[3~"          delete-char
+bindkey    "^[3;5~"         delete-char
+
+# make Ctrl-arrow work
+bindkey "^[[1;5C" forward-word
+bindkey "^[[1;5D" backward-word
+
+# autocomplete
+autoload -Uz compinit
+compinit
+
+# OS-specific things
+if [[ "$OSTYPE" =~ ^linux.*$ ]]; then
+    # Only add local bin if it's not already present
+    [[ ! $PATH == *.local/bin* ]] && PATH=~/.local/bin:$PATH
+
+    {{ if or (eq .chezmoi.hostname "knafeh") (eq .chezmoi.hostname "balozi") }}
+    # Export these variables in our TTY so that Sway can read them when it
+    # starts. It's not pretty, but it's all we can do since support for
+    # ~/.pam_environment was removed from pambase in Arch Linux recently.
+    export MOZ_ENABLE_WAYLAND=1
+    # 2021-06-22: fix "Firefox is already running" message
+    # See: https://mastransky.wordpress.com/2020/03/16/wayland-x11-how-to-run-firefox-in-mixed-environment/
+    export MOZ_DBUS_REMOTE=1
+    export QT_QPA_PLATFORM=wayland-egl
+    export CLUTTER_BACKEND=wayland
+    # 2020-02-10: https://github.com/swaywm/sway/wiki#issues-with-java-applications
+    export _JAVA_AWT_WM_NONREPARENTING=1
+    export SDL_VIDEODRIVER=wayland
+    # Signal to xdg-desktop-portal that we're on Sway
+    export XDG_CURRENT_DESKTOP=sway
+
+    # 2023-02-05: tell pip/poetry not to probe for keyrings. I'm not publishing
+    # packages to pypi.org and the popup during pip/poetry install is annoying.
+    # See: https://github.com/python-poetry/poetry/issues/1917
+    export PYTHON_KEYRING_BACKEND=keyring.backends.null.Keyring
+
+    # For rsync breaking change in arg parsing since 2022
+    # See: https://github.com/bit-team/backintime/issues/1247
+    export RSYNC_OLD_ARGS=1
+    {{- end }}
+
+    {{ if or (eq .chezmoi.hostname "knafeh") (eq .chezmoi.hostname "balozi") }}
+    # 2023-12-27: use Vulkan renderer in Sway
+    # 2024-03-23: still buggy
+    # 2025-01-02: seem to work on newer Intel
+    export WLR_RENDERER=vulkan
+    {{- end }}
+fi
+
+# Enable zsh completions for mise version manager
+if [[ -f /usr/bin/mise ]]; then
+    eval "$(/usr/bin/mise activate zsh)"
+fi
+
+alias ls='ls -F --color=auto'
+alias less='less -R' # preserves colors in GNU coreutils' `less`
+
+# selenized dircolors
+# see: https://github.com/jan-warchol/selenized/tree/master/other-apps/dircolors
+export LS_COLORS="$LS_COLORS:ow=1;7;34:st=30;44:su=30;41"
+
+# Environment
+export PS1='[%n@%m: %~]$ '
+export EDITOR=vim
+export PAGER=less
+
+# resize images using GraphicsMagick
+#
+#   $ smartresize DSC_0788.JPG 1920x1080 outputdir [quality]
+#
+# Similar to the one from SmashingMagazine, but ported to GraphicsMagick
+# see: http://www.smashingmagazine.com/2015/06/efficient-image-resizing-with-imagemagick/
+smartresize() {
+    if [[ -z $4 ]]; then QUALITY=82; else QUALITY=$4; fi
+
+    gm mogrify -filter Triangle -define filter:support=2 -thumbnail $2 -unsharp 2x0.5+0.7+0 -dither -quality $QUALITY -define jpeg:fancy-upsampling=off -define png:compression-filter=5 -define png:compression-level=9 -define png:compression-strategy=1 -define png:exclude-chunk=all -interlace Line -strip -output-directory $3 $1
+}
+
+# optimize jpeg using GraphicsMagick
+#
+#   $ jpegoptimize DSC_0788.JPG outputdir [quality]
+#
+# Similar to smartresize above, but just optmizes the jpeg
+jpegoptimize() {
+    if [[ -z $3 ]]; then QUALITY=82; else QUALITY=$3; fi
+
+    gm mogrify -filter Triangle -define filter:support=2 -unsharp 2x0.5+0.7+0 -dither -quality $QUALITY -define jpeg:fancy-upsampling=off -interlace Line -strip -output-directory $2 $1
+}
+
+# Generate a random hex password 20 characters long. The input from /dev/urandom
+# does not need to be any particular length due to SHA-2 256's design (for exam-
+# ple, the "avalanche" effect and the input padding), so I just read 1 byte with
+# dd. Some sites (see below) recommend using a minimum of 20 characters for hex
+# passwords.
+#
+# See: https://www.ssh.com/academy/ssh/passphrase-generator
+genpass() {
+    dd if=/dev/urandom bs=1 count=1 2>/dev/null | \
+      sha256sum -b | \
+      sed 's/ .*//' | \
+      head -c 20; echo
+}
+
+# set GPG TTY for pinentry-curses
+export GPG_TTY=$(tty)
+
+# Refresh gpg-agent tty in case user switches into an X Session
+gpg-connect-agent updatestartuptty /bye >/dev/null
+
+# Export location to SSH agent socket, see ssh-agent.service
+export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket"
+
+# Speed up JVM start for short-lived Java programs
+# See: https://zeroturnaround.com/rebellabs/your-maven-build-is-slow-speed-it-up/
+export MAVEN_OPTS="-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
+export PATH